CVE-2026-23951

Name of the Vulnerable Software and Affected Versions SumatraPDF (affected versions not specified)

Description SumatraPDF, a multi-format reader for Windows, contains an off-by-one error in the validation code that triggers only with exactly two records. This error causes an integer underflow in the size calculation within the PalmDbReader::GetRecord function when opening a crafted Mobi file. This results in an out-of-bounds heap read, leading to application crashes. The issue may potentially lead to remote code execution via malicious PDF files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.